Mobile NFC security white paper

This new white paper gives an overview of the state-of-the-art of mobile NFC security and analyses the balance between the risks, mitigation and functional requirements of using HCE for mobile payments. A must-read for anyone working in related sectors.

On Java and git style

Very good Java style guide from Google. And writing good commit messages is the sign of a noble collaborator.

Java Card 3.0.5 released

Oracle released JC 3.0.5, including support for Java 7 and 8 and a new Eclipse development plugin. This is great news, but to my knowledge no card vendors currently sell smart cards that support Java Card 3.

Ways to write untestable code

Funny and true.

Useful JCOP Tools site

yobi.be has a good wiki with tips and tricks how to use JCOP Tools simulator etc. in scripts.

MIFARE Classic Tool

A free, open source Android app from heaven for NFC developers: MCT. Discussion here. MCT allows exporting and importing tag data and keys in a fast and intuitive way (most well-known factory keys are included!). Other functions include value and access condition calculators.

Random Oracle

Useful blog about smart cards, mobile NFC, etc.

Return of the son of GPJ

The descendant of the venerable GPJ has been announced. Its easy-to-use command-line is sure to be popular with developers, and it also offers a simplified interface for key provisioning and diversification. Code: https://github.com/martinpaljak/GlobalPlatformPro

Open Software, Protocol and Format Documentation Project

The Understand project (Open Software, Protocol and Format Documentation Project) at GoogleCode has a plethora of information on all kinds of smart cards and readers (mostly contactless).

Java Card programming: best practices

Read and remember. Very useful tips, especially about reducing memory consumption. A short summary of how the JCVM allocates memory is also given, including the amount of overhead per object.

Essentials

Hacking fingerprint USB drives

Excellent hack walkthrough and security analysis of two standard fingerprint-secured USB storage drives. The vendor reacted in a mature, proactive way to the news that their drives were hacked. That's not something you see very often... respect to USB-Secured.com.

Principles of secure Java development.

Nicely elucidated.

Reading public EMV data on a VISA card

The JavaEmvReader project provides a quick and simple way to parse the unsecured information on a VISA card - a bit easier than the alternative mentioned in a previous post.

One example application is described with the embedded element and Google Wallet in a Samsung Nexus S.

Accessing mobile SE in Android

Excellent, detailed tutorial on how to access the embedded secure element in an Android 4.x phone, and the followup on actually sending APDUs to it.

Off-the-shelf MIFARE Classic hacking tools

Looks promising ...

Java Card 3 implementations

The Java Card 3 spec was released by Sun Microsystems (now Oracle) in 2008 but its adoption by vendors has been very slow. A list of currently available Java Card 3 implementations can be found here on OTN. For convenience, here is a shortlist of the vendors:

• CardLogix
• Giesecke&Devrient

RSA-PSS

The concept of a provably secure signature has been around for a while, but there are few implementations for smart cards.

From RSA Labs:

RSA-PSS offers the long-term benefit of higher assurance by narrowing the gap between the widely held assumption that the RSA problem is hard to solve, and the claim that signatures are hard to forge.

First CC EAL7 certified smart card - Samsung

Samsung has developed the world's first Common Criteria EAL7 certified smart card. This will certainly help boost the perception of the smart card as Trusted Execution Environment (TEE), and will only be good for m-commerce.

OTI COPNI wave - mobile NFC plug-in module

OTI has demonstrated impressive out-of-the box thinking with this NFC plug-in module for mobile devices. Basically, if your phone has an audio stereo jack, you can have mobile NFC.

Now the only questions are: which mobile OSes will OTI support, and will the API be open?

If only a few mobile OSes are supported within the first year (or two), then the API had better be open... A closed API would mean that freelance/community developers won't be able to fill the software gap for this device and some will opt for creating competing - and most likely open-source - solutions. This has already happened with mobile phones. Furthermore, integrated chips containing NFC controller+secure element are becoming readily available, as are NFC software libraries, so the entry threshold to the market is clearly not high.